Glossary of Payment and Information Security Terms
Total Page:16
File Type:pdf, Size:1020Kb
PAYMENT CARD INDUSTRY SECURITY STANDARDS COUNCIL Glossary of Payment and Information Security Terms DATA SECURITY ESSENTIALS FOR SMALL MERCHANTS A PRODUCT OF THE PAYMENT CARD INDUSTRY SMALL MERCHANT TASK FORCE VERSION 2.0 | AUGUST 2018 Introduction This Glossary of Payment and Information Security Terms is a supplement to the Guide to Safe Payments, part of the Data Security Essentials for Small Merchants. Its intent is to explain relevant Payment Card Industry (PCI) and information security terms in easy-to-understand language. Definitions for terms marked with an asterisk (*) are based on or derived from definitions in the Payment Card Industry (PCI) Data Security Standard (DSS) and Payment Application Data Security Standard (PA-DSS): Glossary of Terms, Abbreviations, and Acronyms. The latest version of this glossary is considered the authoritative source, and must be referred to for the current and complete PCI DSS and PA-DSS definitions. Please refer to the Data Security Essentials for Small Merchants at the following: RESOURCE URL Guide to Safe Payments https://www.pcisecuritystandards.org/pdfs/Small_ Merchant_Guide_to_Safe_Payments.pdf Common Payment Systems https://www.pcisecuritystandards.org/pdfs/Small_ Merchant_Common_Payment_Systems.pdf Questions to Ask Your Vendors https://www.pcisecuritystandards.org/pdfs/Small_ Merchant_Questions_To_Ask_Your_Vendors.pdf Evaluation Tool https://www.pcisecuritystandards.org/merchants/ This tool is provided for merchant information only. An option for merchants is to use it as a first step to gain insight about security practices relevant to the way they accept payments, to provide their initial responses, and to see their results. Data Security Essentials for Small Merchants: Glossary of Payment and Information Security Terms | August 2018 Copyright 2018 PCI Security Standards Council, LLC. All Rights Reserved. 1 Glossary TERM DEFINITION Acquirer * See Merchant Bank and Payment Processor. Anti-Virus Software * Software program that detects, removes, and protects against malicious software (also called “malware”) including viruses, worms, Trojans or Trojan horses, spyware, adware, and rootkits. Also called “anti-malware software.” Application * Software program or group of programs that runs on a PC, smartphone, tablet, internal server, or web server. Approved Scanning Vendor (ASV) * Company approved by the PCI Security Standards Council to conduct external vulnerability scanning services to identify common weaknesses in system configuration. Authentication * Method for verifying the identity of a person, device, or process attempting to access a computer. To confirm the identity/user is valid, one or more of the following is provided: • A password or passphrase (something the user knows) • A token, smart card, or digital certificate unique to the user (something the user has) • A biometric identifier, such as a fingerprint (something the user is or does) Authorization * In a payment card transaction, authorization occurs when a merchant receives transaction approval after the acquirer validates the transaction with the issuer/processor. Bank Identification Number (BIN) The first six digits (or more) of a payment card number that identifies the financial institution that issued the payment card to the cardholder. Business Need-to-Know The principle that access to systems or data is granted by a user’s business need—only what is necessary for a user’s job function. Card Data / Customer Card Data * At a minimum, card data includes the primary account number (PAN), and may also include cardholder name and expiration date. The PAN is visible on the front of the card and encoded into the card’s magnetic stripe and/or the embedded chip. Also referred to as cardholder data. See also Sensitive Authentication Data for additional data elements which may be part of a payment transaction but which must not be stored after the transaction is authorized. Chip Also known as “EMV Chip.” The microprocessor (or “chip”) on a payment card used when processing transactions in accordance with the international specifications for EMV transactions. Chip and PIN A verification process where a consumer enters their PIN in an EMV Chip-enabled payment terminal when they purchase goods or services. Data Security Essentials for Small Merchants: Glossary of Payment and Information Security Terms | August 2018 Copyright 2018 PCI Security Standards Council, LLC. All Rights Reserved. 2 Glossary TERM DEFINITION Chip and Signature A verification process where a consumer uses their signature with an EMV Chip-enabled payment terminal when they purchase goods or services. Credential Information used to identify and authenticate a user for access to a system. For example, credentials are often the username and password. Credentials may include a fingerprint, retina scan, or a one-time number generated by a portable “token-generator.” Security is stronger when access requires multiple credentials. Cryptography Cryptography is the method of securing data by making it unintelligible to a human or computer. Cryptography is only useful when the intended recipient can reassemble the data into a readable form using a method known only to the sender and receiver. See also Encryption. Cyber-Attack Any offensive action to break into a computer or system. Cyber-attacks can range from installing spyware on a PC, breaking into a payment system to steal card data, or attempting to break critical infrastructure such as an electric power grid. Data Breach A data breach is an incident in which sensitive data may have potentially been viewed, stolen, or used by an unauthorized party. Data breaches may involve card data, personal health information (PHI), personally identifiable information (PII), trade secrets, or intellectual property, etc. Default Password A simple password that comes with new software or hardware. Default passwords (like “admin” or “password” or “123456”) are easily guessed and usually are available via online search. They are intended as a placeholder and offer no real security—and must be changed to a stronger password after installing new software or hardware. Data Security Essentials (DSE) Data Security Essentials for Small Merchants is a set of educational resources and an evaluation tool to help merchants simplify their security and reduce risk. DSE is intended as an alternative approach to the PCI DSS Self-Assessment Questionnaires (SAQs) for those merchants designated as eligible by the payment brands and their acquirers (merchant banks). Electronic Cash Register (ECR) A device that registers and calculates transactions and may print out receipts, but does not accept customer card payments. Also called a “till.” Encryption Process of using cryptography to mathematically convert information into a form unusable except to holders of a specific digital key. Use of encryption protects information by devaluing it to criminals. See also Cryptography. Firewall * Hardware and/or software that protects network resources from unauthorized access. A firewall permits or denies communication between computers or networks with different security levels based upon a set of rules and other criteria. Data Security Essentials for Small Merchants: Glossary of Payment and Information Security Terms | August 2018 Copyright 2018 PCI Security Standards Council, LLC. All Rights Reserved. 3 Glossary TERM DEFINITION Forensic Investigator PCI Forensic Investigators (PFIs) are companies approved by the PCI Council to help determine when and how a card data breach occurred. They perform investigations within the financial industry using proven investigative methodologies and tools. They also work with law enforcement to support stakeholders with any resulting criminal investigations. Hacker A person or organization that attempts to circumvent security measures of computer systems to gain control and access. Usually this is done in an effort to steal card data. Hosting Provider * Offers various services to merchants and other service providers, where their customers’ data is “hosted” or resident on the provider’s servers. Typical services include shared space for multiple merchants on a server, providing a dedicated server for one merchant, or web apps such as a website with “shopping cart” options. Integrated Payment Terminal A payment terminal and electronic cash register in one device that takes payments, registers and calculates transactions, and prints receipts. Integrator/Reseller An integrator/reseller is a company that merchants work with to help set up their payment system. This may include installation, configuration, and support. These companies may also sell the payment devices or applications as part of their service. See also Qualified Integrator Reseller (QIR). Log * A file that is created automatically when certain predefined (often security-related) events occur within a computer system or network. Log data includes date/time stamp, description of the event, and information unique to that event. These files are useful for troubleshooting technical issues or a data breach investigation. Also called an “audit log” or “audit trail.” Malware * Malicious software designed to infiltrate a computer system with the intent of stealing data, or damaging applications or the operating system. Such software typically enters a network during many business-approved activities such as via email or browsing websites. Malware examples include viruses, worms, Trojans (or Trojan horses), spyware, adware, and rootkits. Merchant Bank * A